The DROWN Attack

DROWN stands for 'Decrypting RSA using Obsolete and Weakened Encryption'. In short what this means is that TLS connections to a large proportion of websites, mail servers and VPN's are open to an attack. SSLv2 was first released in 1995 and depreciated in 2011. It was found that 33% of all HTTPs servers and 22% of those with browser trusted certificates are vulnerable to the attack.  In a separate experiment it was found that OpenSSL, released in 1998, could also be vulnerable. By using an unpatched version of SSLv2, an attacker can decrypt a TLS cipher-text in one minute on a single CPU. This is fast enough to enable man-in-the-middle attacks against modern servers. 26% of all HTTPs servers are vulnerable to this attack.

In most cases this vulnerability is simply due to server configurations not being updated. Some embedded devices that have not been updated in years are also vulnerable. OpenSSL, a free Apache toolkit for TLS and SSL protocols, provides an option to disable SSLv2 ciphersuites but unfortunately with the recent attack it was found this option did not seem to work. Luckily this has been patched in January 2016.

Because most people will not buy multiple certificates, a server will use the same RSA private key for both TLS and SSLv2 protocols meaning that any bugs from SSLv2 could easily affect the TLS. The DROWN attack uses this exact method to break encryption.

The frequent series of SSL and TLS vulnerabilities are starting to make website owners numb to the ongoing reports of security issues. There have been at least 10 well publicized security vulnerabilities over the past 5 years and the rate has increased over the past year, the latest of which is the DROWN attack.

Description

DROWN is a serious vulnerability that affects HTTPS and other services that rely on SSL and TLS, some of the essential cryptographic protocols for Internet security. These protocols allow everyone on the Internet to browse the web, use email, shop online, and send instant messages without third-parties being able to read the communication. DROWN allows attackers to break the encryption and read or steal sensitive communications, including passwords, credit card numbers, trade secrets, or financial data. A server is vulnerable to DROWN if:It allows SSLv2 connections OR Its private key is used on any other server that allows SSLv2 connections, even for another protocol.

What can the attackers gain?

Any communication between users and the server. This typically includes, but is not limited to, usernames and passwords, credit card numbers, emails, instant messages, and sensitive documents. Under some common scenarios, an attacker can also impersonate a secure website and intercept or change the content the user sees.

Who is vulnerable?

Websites, mail servers, and other TLS-dependent services are at risk for the DROWN attack, and many popular sites are affected. We used Internet-wide scanning to measure how sites are vulnerable

Is my site vulnerable?

Modern servers and clients use the TLS encryption protocol. However, due to misconfigurations, many servers also still support SSLv2, a 1990s-era predecessor to TLS. This support did not matter in practice, since no up-to-date clients actually use SSLv2. Therefore, even though SSLv2 is known to be badly insecure, until now, merely supporting SSLv2 was not considered a security problem, because clients never used it.

DROWN shows that merely supporting SSLv2 is a threat to modern servers and clients. It allows an attacker to decrypt modern TLS connections between up-to-date clients and servers by sending probes to a server that supports SSLv2 and uses the same private key.

A server is vulnerable to DROWN if:It allows SSLv2 connections. This is surprisingly common, due to misconfiguration and inappropriate default settings. Our measurements show that 17% of HTTPS servers still allow SSLv2 connections.or:Its private key is used on any other server that allows SSLv2 connections, even for another protocol. Many companies reuse the same certificate and key on their web and email servers, for instance. In this case, if the email server supports SSLv2 and the web server does not, an attacker can take advantage of the email server to break TLS connections to the web server. When taking key reuse into account, an additional 16% of HTTPS servers are vulnerable, putting 33% of HTTPS servers at risk.

How do I protect my server?

To protect against DROWN, server operators need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections. This includes web servers, SMTP servers, IMAP and POP servers, and any other software that supports SSL/TLS.

Disabling SSLv2 can be complicated and depends on the specific server software. We provide instructions here for several common products:

OpenSSL: OpenSSL is a cryptographic library used in many server products. For users of OpenSSL, the easiest and recommended solution is to upgrade to a recent OpenSSL version. OpenSSL 1.0.2 users should upgrade to 1.0.2g. OpenSSL 1.0.1 users should upgrade to 1.0.1s. Users of older OpenSSL versions should upgrade to either one of these versions. More details can be found in this OpenSSL blog post.

(Updated March 13th, 16:00 UTC) Microsoft IIS (Windows Server): Support for SSLv2 on the server side is enabled by default only on the OS versions that correspond to IIS 7.0 and IIS 7.5, namely Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008R2. This support can be disabled in the appropriate SSLv2 subkey for 'Server', as outlined in KB245030. Even if users have not taken the steps to disable SSLv2, the export-grade and 56-bit ciphers that make DROWN feasible are not supported by default.

Network Security Services (NSS): NSS is a common cryptographic library built into many server products. NSS versions 3.13 (released back in 2012) and above should have SSLv2 disabled by default. (A small number of users may have enabled SSLv2 manually and will need to take steps to disable it.) Users of older versions should upgrade to a more recent version. We still recommend checking whether your private key is exposed elsewhere

Other affected software and operating systems: Instructions and information for: Apache, Postfix, Nginx, Debian, Red Hat

Browsers and other clients: There is nothing practical that web browsers or other client software can do to prevent DROWN. Only server operators are able to take action to protect against